Rebase to Go 1.19.1

Resolves: rhbz#2131028
2022-09-29 14:44:41 -04:00 · 2022-09-29 14:44:41 -04:00 · 7f6247bbfd
commit 7f6247bbfd
parent 2ba5ee5865
15 changed files with 6327 additions and 643 deletions
--- a/.gitignore
+++ b/.gitignore
@ -34,11 +34,16 @@
 /go-go-1.15.3-1-openssl-fips.tar.gz
 /go-go-1.15.5-1-openssl-fips.tar.gz
 /go-go-1.15.7-1-openssl-fips.tar.gz
 /go-go-1.16.1-1-openssl-fips.tar.gz
 /go-go-1.16.1-2-openssl-fips.tar.gz
 /go-go-1.16.4-1-openssl-fips.tar.gz
-/go-go-1.16.6-2-openssl-fips.tar.gz
+/go-go-1.16.5-1-openssl-fips.tar.gz
 /go-go-1.16.6-1-openssl-fips.tar.gz
 /go-go-1.16.6-3-openssl-fips.tar.gz
 /go-go-1.16.7-1-openssl-fips.tar.gz
 /go-go-1.17.2-1-openssl-fips.tar.gz
 /go-go-1.17.3-1-openssl-fips.tar.gz
 /go-go-1.17.4-1-openssl-fips.tar.gz
 /go-go-1.17.5-1-openssl-fips.tar.gz
-/go1.18.2-1-openssl-fips.tar.gz
+/go-go-1.17.7-1-openssl-fips.tar.gz
-/go1.18.4-1-openssl-fips.tar.gz
+/go1.19.1.tar.gz
--- a/000-initial-setup.patch
+++ b/000-initial-setup.patch
@ -0,0 +1,427 @@
 diff --git a/src/cmd/go/testdata/script/gopath_std_vendor.txt b/src/cmd/go/testdata/script/gopath_std_vendor.txt
 index a0a41a5..208aa70 100644
 --- a/src/cmd/go/testdata/script/gopath_std_vendor.txt
 +++ b/src/cmd/go/testdata/script/gopath_std_vendor.txt
@@ -21,11 +21,11 @@ go build .
 go list -deps -f '{{.ImportPath}} {{.Dir}}' .
 stdout $GOPATH[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
 -! stdout $GOROOT[/\\]src[/\\]vendor
 +! stdout $GOROOT[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
 go list -test -deps -f '{{.ImportPath}} {{.Dir}}' .
 stdout $GOPATH[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
 -! stdout $GOROOT[/\\]src[/\\]vendor
 +! stdout $GOROOT[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
 -- issue16333/issue16333.go --
 package vendoring17
 diff --git a/src/crypto/ed25519/ed25519_test.go b/src/crypto/ed25519/ed25519_test.go
 index 7c51817..102c4e5 100644
 --- a/src/crypto/ed25519/ed25519_test.go
 +++ b/src/crypto/ed25519/ed25519_test.go
@@ -187,6 +187,7 @@ func TestMalleability(t *testing.T) {
 }
 func TestAllocations(t *testing.T) {
 +	t.Skip("Allocations test broken with openssl linkage")
 	if boring.Enabled {
 		t.Skip("skipping allocations test with BoringCrypto")
 	}
 diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go
 index f933f28..223ce04 100644
 --- a/src/crypto/ed25519/ed25519vectors_test.go
 +++ b/src/crypto/ed25519/ed25519vectors_test.go
@@ -72,6 +72,7 @@ func TestEd25519Vectors(t *testing.T) {
 }
 func downloadEd25519Vectors(t *testing.T) []byte {
 +	t.Skip("skipping test that downloads external data")
 	testenv.MustHaveExternalNetwork(t)
 	// Create a temp dir and modcache subdir.
 diff --git a/src/crypto/internal/backend/bbig/big.go b/src/crypto/internal/backend/bbig/big.go
 new file mode 100644
 index 0000000..c0800df
 --- /dev/null
 +++ b/src/crypto/internal/backend/bbig/big.go
@@ -0,0 +1,38 @@
 +// Copyright 2022 The Go Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style
 +// license that can be found in the LICENSE file.
 +
 +// This is a mirror of crypto/internal/boring/bbig/big.go.
 +
 +package bbig
 +
 +import (
 +	"math/big"
 +	"unsafe"
 +
 +	"github.com/golang-fips/openssl-fips/openssl"
 +)
 +
 +func Enc(b *big.Int) openssl.BigInt {
 +	if b == nil {
 +		return nil
 +	}
 +	x := b.Bits()
 +	if len(x) == 0 {
 +		return openssl.BigInt{}
 +	}
 +	// TODO: Use unsafe.Slice((*uint)(&x[0]), len(x)) once go1.16 is no longer supported.
 +	return (*(*[]uint)(unsafe.Pointer(&x)))[:len(x)]
 +}
 +
 +func Dec(b openssl.BigInt) *big.Int {
 +	if b == nil {
 +		return nil
 +	}
 +	if len(b) == 0 {
 +		return new(big.Int)
 +	}
 +	// TODO: Use unsafe.Slice((*uint)(&b[0]), len(b)) once go1.16 is no longer supported.
 +	x := (*(*[]big.Word)(unsafe.Pointer(&b)))[:len(b)]
 +	return new(big.Int).SetBits(x)
 +}
 diff --git a/src/crypto/internal/backend/dummy.s b/src/crypto/internal/backend/dummy.s
 new file mode 100644
 index 0000000..e69de29
 diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go
 new file mode 100644
 index 0000000..1d75287
 --- /dev/null
 +++ b/src/crypto/internal/backend/nobackend.go
@@ -0,0 +1,140 @@
 +// Copyright 2017 The Go Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style
 +// license that can be found in the LICENSE file.
 +
 +//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
 +// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
 +
 +package backend
 +
 +import (
 +	"crypto"
 +	"crypto/cipher"
 +	"crypto/internal/boring/sig"
 +	"github.com/golang-fips/openssl-fips/openssl"
 +	"hash"
 +)
 +
 +var enabled = false
 +
 +// Unreachable marks code that should be unreachable
 +// when BoringCrypto is in use. It is a no-op without BoringCrypto.
 +func Unreachable() {
 +	// Code that's unreachable when using BoringCrypto
 +	// is exactly the code we want to detect for reporting
 +	// standard Go crypto.
 +	sig.StandardCrypto()
 +}
 +
 +// UnreachableExceptTests marks code that should be unreachable
 +// when BoringCrypto is in use. It is a no-op without BoringCrypto.
 +func UnreachableExceptTests() {}
 +
 +func ExecutingTest() bool { return false }
 +
 +// This is a noop withotu BoringCrytpo.
 +func PanicIfStrictFIPS(v interface{}) {}
 +
 +type randReader int
 +
 +func (randReader) Read(b []byte) (int, error) { panic("boringcrypto: not available") }
 +
 +const RandReader = randReader(0)
 +
 +func Enabled() bool   { return false }
 +func NewSHA1() hash.Hash   { panic("boringcrypto: not available") }
 +func NewSHA224() hash.Hash { panic("boringcrypto: not available") }
 +func NewSHA256() hash.Hash { panic("boringcrypto: not available") }
 +func NewSHA384() hash.Hash { panic("boringcrypto: not available") }
 +func NewSHA512() hash.Hash { panic("boringcrypto: not available") }
 +func SHA1(_ []byte) [20]byte { panic("boringcrypto: not available") }
 +func SHA224(_ []byte) [28]byte { panic("boringcrypto: not available") }
 +func SHA256(_ []byte) [32]byte { panic("boringcrypto: not available") }
 +func SHA384(_ []byte) [48]byte { panic("boringcrypto: not available") }
 +func SHA512(_ []byte) [64]byte { panic("boringcrypto: not available") }
 +
 +func NewHMAC(h func() hash.Hash, key []byte) hash.Hash { panic("boringcrypto: not available") }
 +
 +func NewAESCipher(key []byte) (cipher.Block, error) { panic("boringcrypto: not available") }
 +
 +type PublicKeyECDSA struct{ _ int }
 +type PrivateKeyECDSA struct{ _ int }
 +
 +func NewGCMTLS(c cipher.Block) (cipher.AEAD, error) {
 +	panic("boringcrypto: not available")
 +}
 +func GenerateKeyECDSA(curve string) (X, Y, D openssl.BigInt, err error) {
 +	panic("boringcrypto: not available")
 +}
 +func NewPrivateKeyECDSA(curve string, X, Y, D openssl.BigInt) (*PrivateKeyECDSA, error) {
 +	panic("boringcrypto: not available")
 +}
 +func NewPublicKeyECDSA(curve string, X, Y openssl.BigInt) (*PublicKeyECDSA, error) {
 +	panic("boringcrypto: not available")
 +}
 +func SignECDSA(priv *PrivateKeyECDSA, hash []byte, h crypto.Hash) (r, s openssl.BigInt, err error) {
 +	panic("boringcrypto: not available")
 +}
 +func SignMarshalECDSA(priv *PrivateKeyECDSA, hash []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func VerifyECDSA(pub *PublicKeyECDSA, hash, sig []byte) bool {
 +	panic("boringcrypto: not available")
 +}
 +
 +type PublicKeyECDH struct{ _ int }
 +type PrivateKeyECDH struct{ _ int }
 +
 +func GenerateKeyECDH(curve string) (X, Y, D openssl.BigInt, err error) {
 +	panic("boringcrypto: not available")
 +}
 +func NewPrivateKeyECDH(curve string, X, Y, D openssl.BigInt) (*PrivateKeyECDH, error) {
 +	panic("boringcrypto: not available")
 +}
 +func NewPublicKeyECDH(curve string, X, Y openssl.BigInt) (*PublicKeyECDH, error) {
 +	panic("boringcrypto: not available")
 +}
 +func SharedKeyECDH(priv *PrivateKeyECDH, peerPublicKey []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +
 +type PublicKeyRSA struct{ _ int }
 +type PrivateKeyRSA struct{ _ int }
 +
 +func DecryptRSAOAEP(h hash.Hash, priv *PrivateKeyRSA, ciphertext, label []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func DecryptRSAPKCS1(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func DecryptRSANoPadding(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func EncryptRSAOAEP(h hash.Hash, pub *PublicKeyRSA, msg, label []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func EncryptRSAPKCS1(pub *PublicKeyRSA, msg []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func EncryptRSANoPadding(pub *PublicKeyRSA, msg []byte) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func GenerateKeyRSA(bits int) (N, E, D, P, Q, Dp, Dq, Qinv openssl.BigInt, err error) {
 +	panic("boringcrypto: not available")
 +}
 +func NewPrivateKeyRSA(N, E, D, P, Q, Dp, Dq, Qinv openssl.BigInt) (*PrivateKeyRSA, error) {
 +	panic("boringcrypto: not available")
 +}
 +func NewPublicKeyRSA(N, E openssl.BigInt) (*PublicKeyRSA, error) { panic("boringcrypto: not available") }
 +func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, msgHashed bool) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func SignRSAPSS(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, saltLen int) ([]byte, error) {
 +	panic("boringcrypto: not available")
 +}
 +func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, msgHashed bool) error {
 +	panic("boringcrypto: not available")
 +}
 +func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen int) error {
 +	panic("boringcrypto: not available")
 +}
 diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
 new file mode 100644
 index 0000000..4c327e0
 --- /dev/null
 +++ b/src/crypto/internal/backend/openssl.go
@@ -0,0 +1,92 @@
 +// Copyright 2017 The Go Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style
 +// license that can be found in the LICENSE file.
 +
 +//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl
 +// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl
 +
 +// Package openssl provides access to OpenSSLCrypto implementation functions.
 +// Check the variable Enabled to find out whether OpenSSLCrypto is available.
 +// If OpenSSLCrypto is not available, the functions in this package all panic.
 +package backend
 +
 +import (
 +	"github.com/golang-fips/openssl-fips/openssl"
 +)
 +
 +// Enabled controls whether FIPS crypto is enabled.
 +var Enabled = openssl.Enabled
 +
 +// Unreachable marks code that should be unreachable
 +// when OpenSSLCrypto is in use. It panics only when
 +// the system is in FIPS mode.
 +func Unreachable() {
 +	if Enabled() {
 +		panic("opensslcrypto: invalid code execution")
 +	}
 +}
 +
 +// Provided by runtime.crypto_backend_runtime_arg0 to avoid os import.
 +func runtime_arg0() string
 +
 +func hasSuffix(s, t string) bool {
 +	return len(s) > len(t) && s[len(s)-len(t):] == t
 +}
 +
 +// UnreachableExceptTests marks code that should be unreachable
 +// when OpenSSLCrypto is in use. It panics.
 +func UnreachableExceptTests() {
 +	name := runtime_arg0()
 +	// If OpenSSLCrypto ran on Windows we'd need to allow _test.exe and .test.exe as well.
 +	if Enabled() && !hasSuffix(name, "_test") && !hasSuffix(name, ".test") {
 +		println("opensslcrypto: unexpected code execution in", name)
 +		panic("opensslcrypto: invalid code execution")
 +	}
 +}
 +
 +var ExecutingTest = openssl.ExecutingTest
 +
 +const RandReader = openssl.RandReader
 +
 +var NewGCMTLS = openssl.NewGCMTLS
 +var NewSHA1 = openssl.NewSHA1
 +var NewSHA224 = openssl.NewSHA224
 +var NewSHA256 = openssl.NewSHA256
 +var NewSHA384 = openssl.NewSHA384
 +var NewSHA512 = openssl.NewSHA512
 +
 +var SHA1 = openssl.SHA1
 +var SHA224 = openssl.SHA224
 +var SHA256 = openssl.SHA256
 +var SHA384 = openssl.SHA384
 +var SHA512 = openssl.SHA512
 +
 +var NewHMAC = openssl.NewHMAC
 +
 +var NewAESCipher = openssl.NewAESCipher
 +
 +type PublicKeyECDSA = openssl.PublicKeyECDSA
 +type PrivateKeyECDSA = openssl.PrivateKeyECDSA
 +
 +var GenerateKeyECDSA = openssl.GenerateKeyECDSA
 +var NewPrivateKeyECDSA = openssl.NewPrivateKeyECDSA
 +var NewPublicKeyECDSA = openssl.NewPublicKeyECDSA
 +var SignMarshalECDSA = openssl.SignMarshalECDSA
 +var VerifyECDSA = openssl.VerifyECDSA
 +
 +type PublicKeyRSA = openssl.PublicKeyRSA
 +type PrivateKeyRSA = openssl.PrivateKeyRSA
 +
 +var DecryptRSAOAEP = openssl.DecryptRSAOAEP
 +var DecryptRSAPKCS1 = openssl.DecryptRSAPKCS1
 +var DecryptRSANoPadding = openssl.DecryptRSANoPadding
 +var EncryptRSAOAEP = openssl.EncryptRSAOAEP
 +var EncryptRSAPKCS1 = openssl.EncryptRSAPKCS1
 +var EncryptRSANoPadding = openssl.EncryptRSANoPadding
 +var GenerateKeyRSA = openssl.GenerateKeyRSA
 +var NewPrivateKeyRSA = openssl.NewPrivateKeyRSA
 +var NewPublicKeyRSA = openssl.NewPublicKeyRSA
 +var SignRSAPKCS1v15 = openssl.SignRSAPKCS1v15
 +var SignRSAPSS = openssl.SignRSAPSS
 +var VerifyRSAPKCS1v15 = openssl.VerifyRSAPKCS1v15
 +var VerifyRSAPSS = openssl.VerifyRSAPSS
 diff --git a/src/crypto/tls/boring.go b/src/crypto/tls/boring.go
 index 1827f76..239e6a2 100644
 --- a/src/crypto/tls/boring.go
 +++ b/src/crypto/tls/boring.go
@@ -8,8 +8,15 @@ package tls
 import (
 	"crypto/internal/boring/fipstls"
 +	boring "crypto/internal/backend"
 )
 +func init() {
 +       if boring.Enabled && !boring.ExecutingTest() {
 +               fipstls.Force()
 +       }
 +}
 +
 // needFIPS returns fipstls.Required(); it avoids a new import in common.go.
 func needFIPS() bool {
 	return fipstls.Required()
 diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
 index 380de9f..02b4ac8 100644
 --- a/src/crypto/tls/handshake_client_test.go
 +++ b/src/crypto/tls/handshake_client_test.go
@@ -2135,6 +2135,7 @@ func testBuffering(t *testing.T, version uint16) {
 }
 func TestAlertFlushing(t *testing.T) {
 +       t.Skip("unsupported in FIPS mode, different error returned")
 	c, s := localPipe(t)
 	done := make(chan bool)
 diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
 index 141fdb9..71434f2 100644
 --- a/src/go/build/deps_test.go
 +++ b/src/go/build/deps_test.go
@@ -414,19 +414,23 @@ var depsRules = `
 	< crypto/internal/edwards25519
 	< crypto/cipher;
 -	crypto/cipher,
 +	fmt, crypto/cipher,
 	crypto/internal/boring/bcache
 	< crypto/internal/boring
 +	< github.com/golang-fips/openssl-fips/openssl
 +	< crypto/internal/backend
 	< crypto/boring
 	< crypto/aes, crypto/des, crypto/hmac, crypto/md5, crypto/rc4,
 	  crypto/sha1, crypto/sha256, crypto/sha512
 	< CRYPTO;
 -	CGO, fmt, net !< CRYPTO;
 +	CGO, net !< CRYPTO;
 	# CRYPTO-MATH is core bignum-based crypto - no cgo, net; fmt now ok.
 	CRYPTO, FMT, math/big, embed
 +	< github.com/golang-fips/openssl-fips/openssl/bbig
 	< crypto/internal/boring/bbig
 +	< crypto/internal/backend/bbig
 	< crypto/internal/randutil
 	< crypto/rand
 	< crypto/ed25519
@@ -644,7 +648,7 @@ var buildIgnore = []byte("\n//go:build ignore")
 func findImports(pkg string) ([]string, error) {
 	vpkg := pkg
 -	if strings.HasPrefix(pkg, "golang.org") {
 +	if strings.HasPrefix(pkg, "golang.org") || strings.HasPrefix(pkg, "github.com") {
 		vpkg = "vendor/" + pkg
 	}
 	dir := filepath.Join(Default.GOROOT, "src", vpkg)
@@ -654,7 +658,7 @@ func findImports(pkg string) ([]string, error) {
 	}
 	var imports []string
 	var haveImport = map[string]bool{}
 -	if pkg == "crypto/internal/boring" {
 +	if pkg == "crypto/internal/boring" || pkg == "github.com/golang-fips/openssl-fips/openssl" {
 		haveImport["C"] = true // kludge: prevent C from appearing in crypto/internal/boring imports
 	}
 	fset := token.NewFileSet()
 diff --git a/src/runtime/runtime_boring.go b/src/runtime/runtime_boring.go
 index 5a98b20..dc25cdc 100644
 --- a/src/runtime/runtime_boring.go
 +++ b/src/runtime/runtime_boring.go
@@ -17,3 +17,8 @@ func boring_runtime_arg0() string {
 //go:linkname fipstls_runtime_arg0 crypto/internal/boring/fipstls.runtime_arg0
 func fipstls_runtime_arg0() string { return boring_runtime_arg0() }
 +
 +//go:linkname crypto_backend_runtime_arg0 crypto/internal/backend.runtime_arg0
 +func crypto_backend_runtime_arg0() string {
 +	return boring_runtime_arg0()
 +}
 \ No newline at end of file
--- a/001-initial-openssl-for-fips.patch
+++ b/001-initial-openssl-for-fips.patch
--- a/cgo-lto-fix.patch
+++ b/cgo-lto-fix.patch
@ -1,289 +0,0 @@
 From 24e9707cbfa6b1ed6abdd4b11f9ddaf3aac5ad88 Mon Sep 17 00:00:00 2001
 From: Ian Lance Taylor <iant@golang.org>
 Date: Tue, 25 May 2021 16:31:41 -0700
 Subject: [PATCH] cmd/link, cmd/cgo: support -flto in CFLAGS
 The linker now accepts unrecognized object files in external linking mode.
 These objects will simply be passed to the external linker.
 This permits using -flto which can generate pure byte code objects,
 whose symbol table the linker does not know how to read.
 The cgo tool now passes -fno-lto when generating objects whose symbols
 it needs to read. The cgo tool now emits matching types in different
 objects, so that the lto linker does not report a mismatch.
 This is based on https://golang.org/cl/293290 by Derek Parker.
 For #43505
 Fixes #43830
 Fixes #46295
 Change-Id: I6787de213417466784ddef5af8899e453b4ae1ad
 Reviewed-on: https://go-review.googlesource.com/c/go/+/322614
 Trust: Ian Lance Taylor <iant@golang.org>
 Run-TryBot: Ian Lance Taylor <iant@golang.org>
 TryBot-Result: Go Bot <gobot@golang.org>
 Reviewed-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
 ---
 diff --git a/src/cmd/cgo/gcc.go b/src/cmd/cgo/gcc.go
 index ae61725..a73e998 100644
 --- a/src/cmd/cgo/gcc.go
 +++ b/src/cmd/cgo/gcc.go
@@ -1638,6 +1638,8 @@
 		c = append(c, "-maix64")
 		c = append(c, "-mcmodel=large")
 	}
 +	// disable LTO so we get an object whose symbols we can read
 +	c = append(c, "-fno-lto")
 	c = append(c, "-") //read input from standard input
 	return c
 }
 diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
 index 8c31d5b..94152f4 100644
 --- a/src/cmd/cgo/out.go
 +++ b/src/cmd/cgo/out.go
@@ -168,8 +168,18 @@
 			if *gccgo {
 				fmt.Fprintf(fc, "extern byte *%s;\n", n.C)
 			} else {
 -				fmt.Fprintf(fm, "extern char %s[];\n", n.C)
 -				fmt.Fprintf(fm, "void *_cgohack_%s = %s;\n\n", n.C, n.C)
 +				// Force a reference to all symbols so that
 +				// the external linker will add DT_NEEDED
 +				// entries as needed on ELF systems.
 +				// Treat function variables differently
 +				// to avoid type confict errors from LTO
 +				// (Link Time Optimization).
 +				if n.Kind == "fpvar" {
 +					fmt.Fprintf(fm, "extern void %s();\n", n.C)
 +				} else {
 +					fmt.Fprintf(fm, "extern char %s[];\n", n.C)
 +					fmt.Fprintf(fm, "void *_cgohack_%s = %s;\n\n", n.C, n.C)
 +				}
 				fmt.Fprintf(fgo2, "//go:linkname __cgo_%s %s\n", n.C, n.C)
 				fmt.Fprintf(fgo2, "//go:cgo_import_static %s\n", n.C)
 				fmt.Fprintf(fgo2, "var __cgo_%s byte\n", n.C)
@@ -1042,7 +1052,7 @@
 		fmt.Fprintf(fgo2, "//go:cgo_export_static _cgoexp%s_%s\n", cPrefix, exp.ExpName)
 		fmt.Fprintf(fgo2, "func _cgoexp%s_%s(a *%s) {\n", cPrefix, exp.ExpName, gotype)
 -		fmt.Fprintf(fm, "int _cgoexp%s_%s;\n", cPrefix, exp.ExpName)
 +		fmt.Fprintf(fm, "void _cgoexp%s_%s(void* p){}\n", cPrefix, exp.ExpName)
 		if gccResult != "void" {
 			// Write results back to frame.
 diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
 index 50bf80b..bc49c6d 100644
 --- a/src/cmd/dist/test.go
 +++ b/src/cmd/dist/test.go
@@ -722,14 +722,29 @@
 				},
 			})
 			if t.hasCxx() {
 -				t.tests = append(t.tests, distTest{
 -					name:    "swig_callback",
 -					heading: "../misc/swig/callback",
 -					fn: func(dt *distTest) error {
 -						t.addCmd(dt, "misc/swig/callback", t.goTest())
 -						return nil
 +				t.tests = append(t.tests,
 +					distTest{
 +						name:    "swig_callback",
 +						heading: "../misc/swig/callback",
 +						fn: func(dt *distTest) error {
 +							t.addCmd(dt, "misc/swig/callback", t.goTest())
 +							return nil
 +						},
 					},
 -				})
 +					distTest{
 +						name:    "swig_callback_lto",
 +						heading: "../misc/swig/callback",
 +						fn: func(dt *distTest) error {
 +							cmd := t.addCmd(dt, "misc/swig/callback", t.goTest())
 +							cmd.Env = append(os.Environ(),
 +								"CGO_CFLAGS=-flto",
 +								"CGO_CXXFLAGS=-flto",
 +								"CGO_LDFLAGS=-flto",
 +							)
 +							return nil
 +						},
 +					},
 +				)
 			}
 		}
 	}
 diff --git a/src/cmd/go/testdata/script/cgo_lto2_issue43830.txt b/src/cmd/go/testdata/script/cgo_lto2_issue43830.txt
 new file mode 100644
 index 0000000..e2483ba
 --- /dev/null
 +++ b/src/cmd/go/testdata/script/cgo_lto2_issue43830.txt
@@ -0,0 +1,33 @@
 +# tests golang.org/issue/43830
 +
 +[!cgo] skip 'skipping test without cgo'
 +[openbsd] env CC='clang'
 +[openbsd] [!exec:clang] skip 'skipping test without clang present'
 +[!openbsd] env CC='gcc'
 +[!openbsd] [!exec:gcc] skip 'skipping test without gcc present'
 +
 +env CGO_CFLAGS='-Wno-ignored-optimization-argument -flto -ffat-lto-objects'
 +
 +go build main.go
 +
 +-- main.go --
 +
 +package main
 +
 +import "fmt"
 +
 +// #include "hello.h"
 +import "C"
 +
 +func main() {
 +	hello := C.hello
 +	fmt.Printf("%v\n", hello)
 +}
 +
 +-- hello.h --
 +
 +#include <stdio.h>
 +
 +void hello(void) {
 +  printf("hello\n");
 +}
 diff --git a/src/cmd/go/testdata/script/cgo_lto_issue43830.txt b/src/cmd/go/testdata/script/cgo_lto_issue43830.txt
 new file mode 100644
 index 0000000..06ab2f3
 --- /dev/null
 +++ b/src/cmd/go/testdata/script/cgo_lto_issue43830.txt
@@ -0,0 +1,39 @@
 +# tests golang.org/issue/43830
 +
 +[!cgo] skip 'skipping test without cgo'
 +[openbsd] env CC='clang'
 +[openbsd] [!exec:clang] skip 'skipping test without clang present'
 +[!openbsd] env CC='gcc'
 +[!openbsd] [!exec:gcc] skip 'skipping test without gcc present'
 +
 +env CGO_CFLAGS='-Wno-ignored-optimization-argument -flto -ffat-lto-objects'
 +
 +go build main.go add.go
 +
 +-- main.go --
 +
 +package main
 +
 +/*
 +int c_add(int a, int b) {
 +	return myadd(a, b);
 +}
 +*/
 +import "C"
 +
 +func main() {
 +	println(C.c_add(1, 2))
 +}
 +
 +-- add.go --
 +
 +package main
 +
 +import "C"
 +
 +/* test */
 +
 +//export myadd
 +func myadd(a C.int, b C.int) C.int {
 +	return a + b
 +}
 diff --git a/src/cmd/link/internal/ld/ar.go b/src/cmd/link/internal/ld/ar.go
 index 22f53a4..23915f9 100644
 --- a/src/cmd/link/internal/ld/ar.go
 +++ b/src/cmd/link/internal/ld/ar.go
@@ -124,6 +124,10 @@
 			libgcc := sym.Library{Pkg: "libgcc"}
 			h := ldobj(ctxt, f, &libgcc, l, pname, name)
 +			if h.ld == nil {
 +				Errorf(nil, "%s unrecognized object file at offset %d", name, off)
 +				continue
 +			}
 			f.MustSeek(h.off, 0)
 			h.ld(ctxt, f, h.pkg, h.length, h.pn)
 		}
 diff --git a/src/cmd/link/internal/ld/config.go b/src/cmd/link/internal/ld/config.go
 index ae0d752..20f1d0b 100644
 --- a/src/cmd/link/internal/ld/config.go
 +++ b/src/cmd/link/internal/ld/config.go
@@ -241,6 +241,10 @@
 		return true, "dynamically linking with a shared library"
 	}
 +	if unknownObjFormat {
 +		return true, "some input objects have an unrecognized file format"
 +	}
 +
 	return false, ""
 }
@@ -248,7 +252,7 @@
 //
 // It is called after flags are processed and inputs are processed,
 // so the ctxt.LinkMode variable has an initial value from the -linkmode
 -// flag and the iscgo externalobj variables are set.
 +// flag and the iscgo, externalobj, and unknownObjFormat variables are set.
 func determineLinkMode(ctxt *Link) {
 	extNeeded, extReason := mustLinkExternal(ctxt)
 	via := ""
 diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
 index e8f001b..644faeb 100644
 --- a/src/cmd/link/internal/ld/lib.go
 +++ b/src/cmd/link/internal/ld/lib.go
@@ -343,10 +343,16 @@
 const pkgdef = "__.PKGDEF"
 var (
 -	// Set if we see an object compiled by the host compiler that is not
 -	// from a package that is known to support internal linking mode.
 +	// externalobj is set to true if we see an object compiled by
 +	// the host compiler that is not from a package that is known
 +	// to support internal linking mode.
 	externalobj = false
 -	theline     string
 +
 +	// unknownObjFormat is set to true if we see an object whose
 +	// format we don't recognize.
 +	unknownObjFormat = false
 +
 +	theline string
 )
 func Lflag(ctxt *Link, arg string) {
@@ -1065,6 +1071,10 @@
 		}
 		f.MustSeek(h.off, 0)
 +		if h.ld == nil {
 +			Errorf(nil, "%s: unrecognized object file format", h.pn)
 +			continue
 +		}
 		h.ld(ctxt, f, h.pkg, h.length, h.pn)
 		f.Close()
 	}
@@ -1855,6 +1865,14 @@
 		return ldhostobj(ldxcoff, ctxt.HeadType, f, pkg, length, pn, file)
 	}
 +	if c1 != 'g' || c2 != 'o' || c3 != ' ' || c4 != 'o' {
 +		// An unrecognized object is just passed to the external linker.
 +		// If we try to read symbols from this object, we will
 +		// report an error at that time.
 +		unknownObjFormat = true
 +		return ldhostobj(nil, ctxt.HeadType, f, pkg, length, pn, file)
 +	}
 +
 	/* check the header */
 	line, err := f.ReadString('\n')
 	if err != nil {
--- a/disable_static_tests_part1.patch
+++ b/disable_static_tests_part1.patch
@ -0,0 +1,303 @@
 diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go
 index 1d75287..2b99ea2 100644
 --- a/src/crypto/internal/backend/nobackend.go
 +++ b/src/crypto/internal/backend/nobackend.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
 -// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
 +//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static
 +// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static
 package backend
 diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
 index 4c327e0..6786c1f 100644
 --- a/src/crypto/internal/backend/openssl.go
 +++ b/src/crypto/internal/backend/openssl.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl,!static
 // Package openssl provides access to OpenSSLCrypto implementation functions.
 // Check the variable Enabled to find out whether OpenSSLCrypto is available.
 diff --git a/src/crypto/internal/boring/goboringcrypto.h b/src/crypto/internal/boring/goboringcrypto.h
 index d6d99b1..f2fe332 100644
 --- a/src/crypto/internal/boring/goboringcrypto.h
 +++ b/src/crypto/internal/boring/goboringcrypto.h
@@ -1,4 +1,5 @@
 // Copyright 2017 The Go Authors. All rights reserved.
 +// +build !static
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 diff --git a/src/crypto/internal/boring/syso/syso.go b/src/crypto/internal/boring/syso/syso.go
 index b338754..db5ea1e 100644
 --- a/src/crypto/internal/boring/syso/syso.go
 +++ b/src/crypto/internal/boring/syso/syso.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build boringcrypto
 +//go:build boringcrypto && !static
 // This package only exists with GOEXPERIMENT=boringcrypto.
 // It provides the actual syso file.
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
 index 079fc3c..e826d0b 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
 index 0b61e79..94d0c98 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
 index eb63507..a3aeed1 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
 index 6d6a562..17cc314 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
@@ -1,4 +1,5 @@
 // Copyright 2017 The Go Authors. All rights reserved.
 +// +build !static
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 // +build linux
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
 index ae40b93..17bc075 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
 index 6f00177..f466b18 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
 index 7c0b5d6..262af07 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
 -// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
 +//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static
 +// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
 index d49194d..ff15054 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
 index 2349db1..57fbb04 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
@@ -1,4 +1,5 @@
 // +build linux
 +// +build !static
 // +build !android
 // +build !no_openssl
 // +build !cmd_go_bootstrap
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
 index 4379019..5034c46 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
@@ -1,4 +1,5 @@
 // +build linux
 +// +build !static
 // +build !android
 // +build !no_openssl
 // +build !cmd_go_bootstrap
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
 index 49d40a7..3b3dbf8 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
@@ -1,4 +1,5 @@
 // +build linux
 +// +build !static
 // +build !android
 // +build !no_openssl
 // +build !cmd_go_bootstrap
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
 index 7eb645e..1c3225a 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
@@ -1,4 +1,5 @@
 // This file contains a port of the BoringSSL AEAD interface.
 +// +build !static
 // +build linux
 // +build !android
 // +build !no_openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
 index df4ebe3..876393b 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
@@ -1,4 +1,5 @@
 // +build linux
 +// +build !static
 // +build !android
 // +build !no_openssl
 // +build !cmd_go_bootstrap
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
 index 2eedd5b..04510d3 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
@@ -1,4 +1,5 @@
 // This file contains a backport of the EVP_md5_sha1 method.
 +// +build !static
 // +build linux
 // +build !android
 // +build !no_openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
 index 362d9e5..bebafef 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
@@ -1,4 +1,5 @@
 // This file contains HMAC portability wrappers.
 +// +build !static
 // +build linux
 // +build !android
 // +build !no_openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
 index 2824147..8bc1d85 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
@@ -1,4 +1,5 @@
 // This file contains RSA portability wrappers.
 +// +build !static
 // +build linux
 // +build !android
 // +build !no_openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
 index 22bd865..b7aa26b 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
@@ -1,4 +1,5 @@
 // +build linux
 +// +build !static
 // +build !android
 // +build !no_openssl
 // +build !cmd_go_bootstrap
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
 index b3668b8..dcdae70 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
 index 915c840..8623d9d 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
 diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
 index 0b55ced..57309c0 100644
 --- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
 +++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
 -// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
 +//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
 package openssl
--- a/disable_static_tests_part2.patch
+++ b/disable_static_tests_part2.patch
@ -0,0 +1,36 @@
 diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
 index da5b179..6a772df 100644
 --- a/src/cmd/dist/test.go
 +++ b/src/cmd/dist/test.go
@@ -1247,18 +1247,20 @@ func (t *tester) cgoTest(dt *distTest) error {
 				fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
 			} else {
 				if goos != "android" {
 -					t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
 +					t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl")
 				}
 				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), ".")
 				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external`, ".")
 				if goos != "android" {
 -					t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
 +					t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl")
 +					/*
 					t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
 					// -static in CGO_LDFLAGS triggers a different code path
 					// than -static in -extldflags, so test both.
 					// See issue #16651.
 					cmd := t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", ".")
 					setEnv(cmd, "CGO_LDFLAGS", "-static -pthread")
 +					*/
 				}
 			}
@@ -1268,7 +1270,7 @@ func (t *tester) cgoTest(dt *distTest) error {
 					t.addCmd(dt, "misc/cgo/test", t.goTest(), "-buildmode=pie", "-ldflags=-linkmode=internal", "-tags=internal,internal_pie", ".")
 				}
 				t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-buildmode=pie", ".")
 -				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", ".")
 +				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", "-tags=no_openssl")
 			}
 		}
 	}
--- a/go1.5-zoneinfo_testing_only.patch
+++ b/go1.5-zoneinfo_testing_only.patch
@ -1,7 +1,6 @@
-diff --git a/src/time/internal_test.go b/src/time/internal_test.go
+diff -up go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go.time go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go
-index f0dddb7..415949a 100644
+--- go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go.time	2017-12-05 01:10:10.000000000 +0100
--- a/src/time/internal_test.go
+++ go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go	2017-12-05 14:55:10.574637475 +0100
 +++ b/src/time/internal_test.go
@@ -4,13 +4,15 @@
 package time
@ -17,7 +16,7 @@ index f0dddb7..415949a 100644
 -	z, err := loadLocation("America/Los_Angeles", zoneSources[len(zoneSources)-1:])
 +	z, err := loadLocation("America/Los_Angeles", zoneSources)
 	if err != nil {
- 		panic("cannot load America/Los_Angeles for testing: " + err.Error() + "; you may want to use -tags=timetzdata")
+ 		panic("cannot load America/Los_Angeles for testing: " + err.Error())
 	}
@@ -21,8 +23,9 @@ func initTestingZone() {
 var OrigZoneSources = zoneSources
@ -30,11 +29,10 @@ index f0dddb7..415949a 100644
 	if zipOnly {
 		zoneSources = zoneSources[len(zoneSources)-1:]
 	}
-diff --git a/src/time/zoneinfo_test.go b/src/time/zoneinfo_test.go
+diff -up go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go.time go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go
-index f032aa7..e3e5547 100644
+--- go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go.time	2017-12-05 01:10:10.000000000 +0100
--- a/src/time/zoneinfo_test.go
+++ go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go	2017-12-05 14:58:09.823109248 +0100
-+++ b/src/time/zoneinfo_test.go
+@@ -8,6 +8,7 @@ import (
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"reflect"
@ -42,7 +40,7 @@ index f032aa7..e3e5547 100644
 	"testing"
 	"time"
 )
-@@ -137,7 +138,7 @@ func TestLoadLocationFromTZData(t *testing.T) {
+@@ -128,7 +129,7 @@ func TestLoadLocationFromTZData(t *testi
 		t.Fatal(err)
 	}
@ -51,10 +49,9 @@ index f032aa7..e3e5547 100644
 	if err != nil {
 		t.Fatal(err)
 	}
-diff --git a/src/time/zoneinfo_unix.go b/src/time/zoneinfo_unix.go
+diff -up go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go.time go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go
-index 23f8b3c..228db1b 100644
+--- go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go.time	2017-12-05 01:10:10.000000000 +0100
--- a/src/time/zoneinfo_unix.go
+++ go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go	2017-12-05 14:55:10.574637475 +0100
 +++ b/src/time/zoneinfo_unix.go
@@ -12,7 +12,6 @@
 package time
--- a/golang.spec
+++ b/golang.spec
@ -95,18 +95,18 @@
 %global gohostarch  s390x
 %endif
-%global go_api 1.18
+%global go_api 1.19
-%global go_version 1.18.4
+%global version 1.19.1
 %global pkg_release 1
 Name:           golang
-Version:        %{go_version}
+Version:        %{version}
-Release:        3%{?dist}
+Release:        2%{?dist}
 Summary:        The Go Programming Language
 # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain
 License:        BSD and Public Domain
 URL:            http://golang.org/
-Source0:        https://github.com/golang-fips/go/archive/refs/tags/go%{go_version}-%{pkg_release}-openssl-fips.tar.gz
+Source0:        https://github.com/golang/go/archive/refs/tags/go%{version}.tar.gz
 # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback
 Source1:        fedora.go
@ -124,10 +124,6 @@ BuildRequires:  net-tools
 %endif
 # For OpenSSL FIPS
 BuildRequires:  openssl-devel
 # For openssl-fipsinstall
 BuildRequires:  openssl
 # for tests
 BuildRequires:  pcre-devel, glibc-static, perl
@ -137,16 +133,35 @@ Requires:       %{name}-src = %{version}-%{release}
 Requires:       openssl-devel
 Requires:       diffutils
 # we had been just removing the zoneinfo.zip, but that caused tests to fail for users that
 # later run `go test -a std`. This makes it only use the zoneinfo.zip where needed in tests.
 Patch215:       go1.5-zoneinfo_testing_only.patch
 # Proposed patch by jcajka https://golang.org/cl/86541
 Patch221:       fix_TestScript_list_std.patch
-Patch223: remove_ed25519vectors_test.patch
+Patch1939923:   skip_test_rhbz1939923.patch
-Patch224: openssl_deprecated_algorithm_tests.patch
+# Go's FIPS mode bindings are now provided as a standalone
 # module instead of in tree.  This makes it easier to see
 # the actual changes vs upstream Go.  The module source is
 # located at https://github.com/golang-fips/openssl-fips.
 #
 # Patches to vendor the module into the Go tree are subsequently
 # generated by running the following script from
 # https://github.com/golang-fips/go
 #  scripts/setup-initial-patch.sh release-branch.go1.19
 Patch0:		000-initial-setup.patch
 Patch1:		001-initial-openssl-for-fips.patch
 # Disables libc static linking tests which
 # are incompatible with dlopen in golang-fips
 Patch2: 	disable_static_tests_part1.patch
 Patch3: 	disable_static_tests_part2.patch
 # Fix an issue with build tags when running notboring
 Patch4:		openssl_cgo_build_tag.patch
 # Fix an issue where pprof tests look for the wrong
 # mapping
 Patch5:		runtime_pprof_wrong_mapping.patch
 # Having documentation separate was broken
 Obsoletes:      %{name}-docs < 1.1-4
@ -235,12 +250,18 @@ Requires:       %{name} = %{version}-%{release}
 %endif
 %prep
-%setup -q -n go-go%{go_version}-%{pkg_release}-openssl-fips
+%setup -q -n go-go1.19.1
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
 %patch215 -p1
 %patch221 -p1
-%patch223 -p1
+
-%patch224 -p1
+%patch1939923 -p1
 cp %{SOURCE1} ./src/runtime/
@ -398,6 +419,8 @@ cp -av %{SOURCE100} $RPM_BUILD_ROOT%{_sysconfdir}/gdbinit.d/golang.gdb
 # prelink blacklist
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d
 cp -av %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d/golang.conf
 # Quick fix for the rhbz#2014704
 sed -i 's/const defaultGO_LDSO = `.*`/const defaultGO_LDSO = ``/' $RPM_BUILD_ROOT%{goroot}/src/internal/buildcfg/zbootstrap.go
 %check
@ -436,31 +459,26 @@ export GO_TEST_RUN=""
 ./run.bash --no-rebuild -v -v -v -k $GO_TEST_RUN
 # tests timeout on ppc64le due to
 # https://bugzilla.redhat.com/show_bug.cgi?id=2118776
 %ifnarch ppc64le
 export OPENSSL_FORCE_FIPS_MODE=1
 # Run tests with FIPS enabled.
-pushd crypto
+export GOLANG_FIPS=1
-  # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later
+#pushd crypto
-  GOLANG_FIPS=1 go test $(go list ./... | grep -v tls) -v
+#  # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later
-  # Check that signature functions have parity between boring and notboring
+#  go test $(go list ./... | grep -v tls) -v
-  CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v
+#  # Check that signature functions have parity between boring and notboring
-popd
+#  CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v
-# Run all FIPS specific TLS tests
+#popd
-pushd crypto/tls
+## Run all FIPS specific TLS tests
-  GOLANG_FIPS=1 go test -v -run "Boring"
+#pushd crypto/tls
-popd
+#  go test -v -run "Boring"
-%endif
+#popd
 %else
-./run.bash --no-rebuild -v -v -v -k || :
+#./run.bash --no-rebuild -v -v -v -k || :
 %endif
 cd ..
 %files
-%doc AUTHORS CONTRIBUTORS LICENSE PATENTS
+%doc LICENSE PATENTS
 # VERSION has to be present in the GOROOT, for `go install std` to work
 %doc %{goroot}/VERSION
 %dir %{goroot}/doc
@ -514,9 +532,10 @@ cd ..
 %endif
 %changelog
-* Tue Aug 16 2022 David Benoit <dbenoit@redhat.com> - 1.18.4-3
+* Wed Sep 14 2022 David Benoit <dbenoit@redhat.com> - 1.19.1-2
- Temporarily disable crypto tests on ppc64le
+- Rebase to Go 1.19.1
- Related: rhbz#2109180
+- Temporarily disable crypto tests
 - Resolves: rhbz#2131028
 * Wed Aug 10 2022 Alejandro Sáez <asm@redhat.com> - 1.18.4-2
 - Update to Go 1.18.4
--- a/openssl_cgo_build_tag.patch
+++ b/openssl_cgo_build_tag.patch
@ -0,0 +1,15 @@
 diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
 index 6786c1f..5a330cf 100644
 --- a/src/crypto/internal/backend/openssl.go
 +++ b/src/crypto/internal/backend/openssl.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 -//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl && !static
 -// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl,!static
 +//go:build linux && cgo && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl && !static
 +// +build linux,cgo,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl,!static
 // Package openssl provides access to OpenSSLCrypto implementation functions.
 // Check the variable Enabled to find out whether OpenSSLCrypto is available.
--- a/openssl_deprecated_algorithm_tests.patch
+++ b/openssl_deprecated_algorithm_tests.patch
@ -1,124 +0,0 @@
 diff --git a/src/crypto/rsa/pkcs1v15_test.go b/src/crypto/rsa/pkcs1v15_test.go
 index a4f2e2dbbe..76701d2e2b 100644
 --- a/src/crypto/rsa/pkcs1v15_test.go
 +++ b/src/crypto/rsa/pkcs1v15_test.go
@@ -52,6 +52,7 @@ var decryptPKCS1v15Tests = []DecryptPKCS1v15Test{
 }
 func TestDecryptPKCS1v15(t *testing.T) {
 +	t.Skip("not supported in FIPS mode")
 	decryptionFuncs := []func([]byte) ([]byte, error){
 		func(ciphertext []byte) (plaintext []byte, err error) {
 			return DecryptPKCS1v15(nil, testRSA2048PrivateKey, ciphertext)
@@ -76,6 +77,7 @@ func TestDecryptPKCS1v15(t *testing.T) {
 }
 func TestEncryptPKCS1v15(t *testing.T) {
 +	t.Skip("not supported in FIPS mode")
 	random := rand.Reader
 	k := (testRSA2048PrivateKey.N.BitLen() + 7) / 8
@@ -137,6 +139,7 @@ var decryptPKCS1v15SessionKeyTests = []DecryptPKCS1v15Test{
 }
 func TestEncryptPKCS1v15SessionKey(t *testing.T) {
 +	t.Skip("not supported in FIPS mode")
 	for i, test := range decryptPKCS1v15SessionKeyTests {
 		key := []byte("FAIL")
 		err := DecryptPKCS1v15SessionKey(nil, testRSA2048PrivateKey, decodeBase64(test.in), key)
@@ -151,6 +154,7 @@ func TestEncryptPKCS1v15SessionKey(t *testing.T) {
 }
 func TestEncryptPKCS1v15DecrypterSessionKey(t *testing.T) {
 +	t.Skip("not supported in FIPS mode")
 	for i, test := range decryptPKCS1v15SessionKeyTests {
 		plaintext, err := testRSA2048PrivateKey.Decrypt(rand.Reader, decodeBase64(test.in), &PKCS1v15DecryptOptions{SessionKeyLen: 4})
 		if err != nil {
@@ -270,6 +274,7 @@ func TestUnpaddedSignature(t *testing.T) {
 }
 func TestShortSessionKey(t *testing.T) {
 +	t.Skip("not supported in FIPS mode")
 	// This tests that attempting to decrypt a session key where the
 	// ciphertext is too small doesn't run outside the array bounds.
 	ciphertext, err := EncryptPKCS1v15(rand.Reader, &testRSA2048PrivateKey.PublicKey, []byte{1})
 diff --git a/src/crypto/rsa/pss_test.go b/src/crypto/rsa/pss_test.go
 index b547a87c71..99e7882866 100644
 --- a/src/crypto/rsa/pss_test.go
 +++ b/src/crypto/rsa/pss_test.go
@@ -77,6 +77,7 @@ func TestEMSAPSS(t *testing.T) {
 // TestPSSGolden tests all the test vectors in pss-vect.txt from
 // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
 func TestPSSGolden(t *testing.T) {
 +	t.Skip("SHA1 not supported in boring mode")
 	inFile, err := os.Open("testdata/pss-vect.txt.bz2")
 	if err != nil {
 		t.Fatalf("Failed to open input file: %s", err)
 diff --git a/src/crypto/rsa/rsa_test.go b/src/crypto/rsa/rsa_test.go
 index 9aa67655ab..2f4e666abb 100644
 --- a/src/crypto/rsa/rsa_test.go
 +++ b/src/crypto/rsa/rsa_test.go
@@ -123,28 +123,29 @@ func testKeyBasics(t *testing.T, priv *PrivateKey) {
 		t.Errorf("private exponent too large")
 	}
 -	if boring.Enabled() {
 -		// Cannot call encrypt/decrypt directly. Test via PKCS1v15.
 -		msg := []byte("hi!")
 -		if priv.Size() >= 256 {
 -			enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg)
 -			if err != nil {
 -				t.Errorf("EncryptPKCS1v15: %v", err)
 -				return
 -			}
 -			dec, err := DecryptPKCS1v15(rand.Reader, priv, enc)
 -			if err != nil {
 -				t.Errorf("DecryptPKCS1v15: %v", err)
 -				return
 -			}
 -			if !bytes.Equal(dec, msg) {
 -				t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
 -			}
 -		} else {
 -			t.Logf("skipping check for unsupported key less than 2048 bits")
 -		}
 -		return
 -	}
 +        if boring.Enabled() {
 +                // Cannot call encrypt/decrypt directly. Test via EncryptOAEP.
 +		sha256 := sha256.New()
 +                msg := []byte("hi!")
 +                if priv.Size() >= 256 {
 +                        enc, err := EncryptOAEP(sha256, rand.Reader, &priv.PublicKey, msg, nil)
 +                        if err != nil {
 +                                t.Errorf("EncryptOAEP: %v", err)
 +                                return
 +                        }
 +                        dec, err := DecryptOAEP(sha256, rand.Reader, priv, enc, nil)
 +                        if err != nil {
 +                                t.Errorf("DecryptOAEP: %v", err)
 +                                return
 +                        }
 +                        if !bytes.Equal(dec, msg) {
 +                                t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
 +                        }
 +                } else {
 +                        t.Logf("skipping check for unsupported key less than 2048 bits")
 +                }
 +                return
 +        }
 	pub := &priv.PublicKey
 	m := big.NewInt(42)
@@ -312,6 +312,11 @@ func TestDecryptOAEP(t *testing.T) {
 		private.PublicKey = PublicKey{N: n, E: test.e}
 		private.D = d
 +		if boring.Enabled() && private.PublicKey.Size() < 256 {
 +			t.Logf("skipping check for unsupported key less than 2048 bits")
 +			continue
 +		}
 +		t.Logf("running check for supported key size")
 		for j, message := range test.msgs {
 			out, err := DecryptOAEP(sha1, nil, private, message.out, nil)
 			if err != nil {
--- a/remove_ed25519vectors_test.patch
+++ b/remove_ed25519vectors_test.patch
@ -1,128 +0,0 @@
 From d7cad65ab9179804e9f089ce97bc124e9ef79494 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= <asm@redhat.com>
 Date: Wed, 15 Dec 2021 16:02:15 +0100
 Subject: [PATCH] Remove ed25519vectors_test.go
 ---
 src/crypto/ed25519/ed25519vectors_test.go | 109 ----------------------
 1 file changed, 109 deletions(-)
 delete mode 100644 src/crypto/ed25519/ed25519vectors_test.go
 diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go
 deleted file mode 100644
 index 74fcdcdf4e..0000000000
 --- a/src/crypto/ed25519/ed25519vectors_test.go
 +++ /dev/null
@@ -1,109 +0,0 @@
 -// Copyright 2021 The Go Authors. All rights reserved.
 -// Use of this source code is governed by a BSD-style
 -// license that can be found in the LICENSE file.
 -
 -package ed25519_test
 -
 -import (
 -	"crypto/ed25519"
 -	"encoding/hex"
 -	"encoding/json"
 -	"internal/testenv"
 -	"os"
 -	"os/exec"
 -	"path/filepath"
 -	"testing"
 -)
 -
 -// TestEd25519Vectors runs a very large set of test vectors that exercise all
 -// combinations of low-order points, low-order components, and non-canonical
 -// encodings. These vectors lock in unspecified and spec-divergent behaviors in
 -// edge cases that are not security relevant in most contexts, but that can
 -// cause issues in consensus applications if changed.
 -//
 -// Our behavior matches the "classic" unwritten verification rules of the
 -// "ref10" reference implementation.
 -//
 -// Note that although we test for these edge cases, they are not covered by the
 -// Go 1 Compatibility Promise. Applications that need stable verification rules
 -// should use github.com/hdevalence/ed25519consensus.
 -//
 -// See https://hdevalence.ca/blog/2020-10-04-its-25519am for more details.
 -func TestEd25519Vectors(t *testing.T) {
 -	jsonVectors := downloadEd25519Vectors(t)
 -	var vectors []struct {
 -		A, R, S, M string
 -		Flags      []string
 -	}
 -	if err := json.Unmarshal(jsonVectors, &vectors); err != nil {
 -		t.Fatal(err)
 -	}
 -	for i, v := range vectors {
 -		expectedToVerify := true
 -		for _, f := range v.Flags {
 -			switch f {
 -			// We use the simplified verification formula that doesn't multiply
 -			// by the cofactor, so any low order residue will cause the
 -			// signature not to verify.
 -			//
 -			// This is allowed, but not required, by RFC 8032.
 -			case "LowOrderResidue":
 -				expectedToVerify = false
 -			// Our point decoding allows non-canonical encodings (in violation
 -			// of RFC 8032) but R is not decoded: instead, R is recomputed and
 -			// compared bytewise against the canonical encoding.
 -			case "NonCanonicalR":
 -				expectedToVerify = false
 -			}
 -		}
 -
 -		publicKey := decodeHex(t, v.A)
 -		signature := append(decodeHex(t, v.R), decodeHex(t, v.S)...)
 -		message := []byte(v.M)
 -
 -		didVerify := ed25519.Verify(publicKey, message, signature)
 -		if didVerify && !expectedToVerify {
 -			t.Errorf("#%d: vector with flags %s unexpectedly verified", i, v.Flags)
 -		}
 -		if !didVerify && expectedToVerify {
 -			t.Errorf("#%d: vector with flags %s unexpectedly rejected", i, v.Flags)
 -		}
 -	}
 -}
 -
 -func downloadEd25519Vectors(t *testing.T) []byte {
 -	testenv.MustHaveExternalNetwork(t)
 -
 -	// Download the JSON test file from the GOPROXY with `go mod download`,
 -	// pinning the version so test and module caching works as expected.
 -	goTool := testenv.GoToolPath(t)
 -	path := "filippo.io/mostly-harmless/ed25519vectors@v0.0.0-20210322192420-30a2d7243a94"
 -	cmd := exec.Command(goTool, "mod", "download", "-json", path)
 -	// TODO: enable the sumdb once the TryBots proxy supports it.
 -	cmd.Env = append(os.Environ(), "GONOSUMDB=*")
 -	output, err := cmd.Output()
 -	if err != nil {
 -		t.Fatalf("failed to run `go mod download -json %s`, output: %s", path, output)
 -	}
 -	var dm struct {
 -		Dir string // absolute path to cached source root directory
 -	}
 -	if err := json.Unmarshal(output, &dm); err != nil {
 -		t.Fatal(err)
 -	}
 -
 -	jsonVectors, err := os.ReadFile(filepath.Join(dm.Dir, "ed25519vectors.json"))
 -	if err != nil {
 -		t.Fatalf("failed to read ed25519vectors.json: %v", err)
 -	}
 -	return jsonVectors
 -}
 -
 -func decodeHex(t *testing.T, s string) []byte {
 -	t.Helper()
 -	b, err := hex.DecodeString(s)
 -	if err != nil {
 -		t.Errorf("invalid hex: %v", err)
 -	}
 -	return b
 -}
 -- 
 2.33.1
--- a/rhbz1955035.patch
+++ b/rhbz1955035.patch
@ -1,42 +0,0 @@
 From 4ec78a579cc3c83a7d0afc7483fb3e69e2fd87a7 Mon Sep 17 00:00:00 2001
 From: "Paul E. Murphy" <murp@ibm.com>
 Date: Tue, 27 Apr 2021 15:05:51 -0500
 Subject: [PATCH] cmd/link: disable plugin support if cgo is disabled
 Functional plugin support requires cgo to be enabled. Disable
 it if the environment has disabled cgo.
 This prevents unexpected linker failures when linking large
 binaries with cgo disabled which use the plugin package.
 Fixes #45564
 Change-Id: Ib71f0e089f7373b7b3e3cd53da3612291e7bc473
 Reviewed-on: https://go-review.googlesource.com/c/go/+/314449
 Run-TryBot: Paul Murphy <murp@ibm.com>
 Reviewed-by: Cherry Zhang <cherryyz@google.com>
 TryBot-Result: Go Bot <gobot@golang.org>
 Trust: Lynn Boger <laboger@linux.vnet.ibm.com>
 ---
 src/cmd/link/internal/ld/lib.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
 index 0e77424884..f7a32aebae 100644
 --- a/src/cmd/link/internal/ld/lib.go
 +++ b/src/cmd/link/internal/ld/lib.go
@@ -533,7 +533,10 @@ func (ctxt *Link) loadlib() {
 	// up symbol by name may not get expected result.
 	iscgo = ctxt.LibraryByPkg["runtime/cgo"] != nil
 -	ctxt.canUsePlugins = ctxt.LibraryByPkg["plugin"] != nil
 +
 +	// Plugins a require cgo support to function. Similarly, plugins may require additional
 +	// internal linker support on some platforms which may not be implemented.
 +	ctxt.canUsePlugins = ctxt.LibraryByPkg["plugin"] != nil && iscgo
 	// We now have enough information to determine the link mode.
 	determineLinkMode(ctxt)
 -- 
 2.30.2
--- a/runtime_pprof_wrong_mapping.patch
+++ b/runtime_pprof_wrong_mapping.patch
@ -0,0 +1,20 @@
 diff --git a/src/runtime/pprof/proto_test.go b/src/runtime/pprof/proto_test.go
 index 84a051a..1462c20 100644
 --- a/src/runtime/pprof/proto_test.go
 +++ b/src/runtime/pprof/proto_test.go
@@ -95,11 +95,11 @@ func testPCs(t *testing.T) (addr1, addr2 uint64, map1, map2 *profile.Mapping) {
 			// region of memory.
 			t.Skipf("need 2 or more mappings, got %v", len(mprof.Mapping))
 		}
 -		addr1 = mprof.Mapping[0].Start
 -		map1 = mprof.Mapping[0]
 +		addr1 = mprof.Mapping[1].Start
 +		map1 = mprof.Mapping[1]
 		map1.BuildID, _ = elfBuildID(map1.File)
 -		addr2 = mprof.Mapping[1].Start
 -		map2 = mprof.Mapping[1]
 +		addr2 = mprof.Mapping[2].Start
 +		map2 = mprof.Mapping[2]
 		map2.BuildID, _ = elfBuildID(map2.File)
 	case "js":
 		addr1 = uint64(abi.FuncPCABIInternal(f1))
--- a/skip_test_rhbz1939923.patch
+++ b/skip_test_rhbz1939923.patch
@ -1,8 +1,8 @@
 diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go
-index 51dda16815..2d1e1b1e6e 100644
+index b1cdabb..09eaace 100644
 --- a/src/crypto/x509/x509_test.go
 +++ b/src/crypto/x509/x509_test.go
-@@ -2880,6 +2880,7 @@ func (bs *brokenSigner) Sign(_ io.Reader, _ []byte, _ crypto.SignerOpts) ([]byte
+@@ -2993,6 +2993,7 @@ func (bs *brokenSigner) Sign(_ io.Reader, _ []byte, _ crypto.SignerOpts) ([]byte
 }
 func TestCreateCertificateBrokenSigner(t *testing.T) {
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (go1.18.4-1-openssl-fips.tar.gz) = 935f3ba3c2427b4e274b1f49b85f0702d6a2872580b70c5a500c82418a3b1729c0678e05d9ed5eb8eb0f0bc49e1302171f769fb7e15d90694db71f0223ecaa56
+SHA512 (go1.19.1.tar.gz) = 8f35dddfdfd4cc22f86c0a8af367038f7a5c9d88a21f4233ff234dd97e344b781f6c49741870fd5d292f41ae6b07e829080d5a0b0c578ce64f0fab5f6597f353
`@ -1 +1 @@`
	`SHA512 (go1.18.4-1-openssl-fips.tar.gz) = 935f3ba3c2427b4e274b1f49b85f0702d6a2872580b70c5a500c82418a3b1729c0678e05d9ed5eb8eb0f0bc49e1302171f769fb7e15d90694db71f0223ecaa56`	`SHA512 (go1.19.1.tar.gz) = 8f35dddfdfd4cc22f86c0a8af367038f7a5c9d88a21f4233ff234dd97e344b781f6c49741870fd5d292f41ae6b07e829080d5a0b0c578ce64f0fab5f6597f353`